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Description 

This invention relates to an apparatus for moni- 
toring the use of software in a computer system 
with respect to at least one selected aspect of such 
use, the computer system having a central proces- 
sor containing the software, and the central proces- 
sor being accessed by at least one operator termi- 
nal connected to it. More particularly, the invention 
relates to a combination software and hardware 
device for use with computer systems having one 
or more consoles or terminals connected to a cen- 
tral processing unit 

Computer software, programs, or packages of 
programs are often licensed by the developer or 
other supplier to the user or customer. The soft- 
ware licence may provide that, for a prescribed 
payment, the program may be used a given num- 
ber of times, or for a given number of hours, or on 
a particular computer system, or on a given num- 
ber of terminals. Licensing of software on a per 
terminal basis would be highly desirable as a con- 
venient way to distinguish small users from large 
users and adjusting payments accordingly. 

However, once the software is provided to the 
customer by the' supplier, it is currently very dif- 
ficult for the supplier thereafter to control the ac- 
cess, use. or transfer of the software. It is cor- 
respondingly difficult for the supplier to police the 
software licence. As a result, suppliers are often 
reluctant to enter into limited licences. The advan- 
tages of such licences, for example lower cost to 
small users or flexible pricing, are lost. 

Techniques for the control or protection of 
computer programs currently use either a software 
approach or a hardware approach. A hardware ap- 
proach to preventing unauthorised use of computer 
programs typically employs a physical key, such 
as a specially-coded card which must be inserted 
in a lock in the computer system before access 
can be had to the program. The key provides data, 
such as an electronic serial number or authorisation 
number. The correctness of the data must be prop- 
erly verified before a program can be run. Alter- 
natively, a programmable read-only memory 
(PROM) may be inserted in the computer system. 
The program then detects an authorisation number 
in the PROM to permit the program to operate. 
Another approach is to put authorisation data, such 
as a serial number, physically in the circuitry of the 
computer system. When the program is initially 
run, the authorisation data of the computer system 
are entered in a blank in the program. Thereafter, 
the program will only run if the authorisation data 
are present. 

While the security provided to the program is 
high with the hardware approach, there are factors 
which limit its use. A major drawback is cost, both 



In the key and in the modification to the computer 
system. This has tended to limit the hardware 
approach to protection of large, expensive software 
programs. Many manufacturers do not put a serial 

5 number in the circuitry of the computer. Also, if the 
computer circuitry must be changed, there is a 
problem of getting the new authorisation data into 
the program. Further, the hardware approach is not 
particularly well suited for situations where use of 

10 the program is to be permitted, but under limited 
conditions. 

in the software approach to program protection, 
the program is altered by encryption techniques so 
that it is not accessible without a software key 

75 placed on the medium containing the program, 
such as a computer disc. The software approach is 
less expensive than the hardware approach but 
less secure. Furthermore, there are several prob- 
lems in the software approach. One is that it pre- 

20 vents legitimate copying as where an authorised 
user wishes to make a back-up copy of the pro- 
gram. A second drawback is that devices known as 
nibble copiers can duplicate all the software on the 
disc, Including the software key. so that the secu- 

25 rity is greatly compromised. Nor does the software 
approach protect against an unauthorised taking of 
the program from one computer system to another, 
since the security data are transferred along with 
the program. 

30 Because of the shortcomings of the hardware 
only and software only approaches, combined soft- 
ware and hardware techniques are becoming avail- 
able. One such approach to the prevention of copy- 
ing places a unique pattern or fingerprint on blank 
35 media, such as floppy discs, for storing the pro- 
gram. The program is placed on the disc by the 
rfianufacturer through software that encrypts the 
program source code several times to link the 
encrypted program to the unique pattern. The pro- 
40 gram can then be accessed only if the pattern is 
pcesent, thus preventing copying of the program. 
However, this, and similar approaches, are limited 
to the media element of the computer system. 
None of the foregoing techniques • permit 
45 authorised use, whilst preventing use of the pro- 
gram or software outside limits authorised or estab- 
lished in a software licence. 

US-A-3806882 describes a system that con- 
trols access to information stored in a computer by 
50 means of a portable electronic key device which 
either prevents or allows access to the computer, 

JP-A-57-97162 relates to preventing access to 
a central data file. A terminal discriminating and 
processing part determines whether a requesting 
55 end user is an authorised user or not Only 
authorised users are permitted access to the files, 
but once in have unlimited use. 

JP-A-58-82355 prevents improper use of porta- 
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ble terminal equipment by registering information 
for preventing improper use. and its permitted fre- 
quency of error. Wlien an error count of input data 
exceeds the previously registered penmitted error 
frequency, the equipment is made ineffective. 

The present invention is directed to a software- 
hardware device for controlling access to a main or 
host computer, and the programming contained 
therein, from one or more computer terminals or 
consoles. The access may be controlled in accor- 
dance within limits established in a software 
licence. 

According to the invention there is provided 
apparatus for monitoring the use of software in a 
computer system with respect to at least one se- 
lected aspect of such use, the computer system 
having a central processor containing the software, 
the central processor being accessed by at least 
one operator terminal connected to the central pro- 
cessor; the apparatus comprising receiving means 
coupled to the central processor, memory means 
for containing data establishing the software usage 
limit for the selected aspect, microprocessor con- 
trol means, and interrupt means; characterised in 
that the software in the central processor generates 
usage data indicative of monitored software usage 
for the selected aspect of the computer system, 
the apparatus employing at least one pre-estab- 
lished level of occurrences of conditions violating 
the usage limit for the selected aspect when moni- 
toring use of the software; in that the receiving 
means is coupled to the central processor for re- 
ceiving the monitored software usage data from 
software in the central processor; in that the mem- 
ory means contains data establishing the pre-es- 
tablished level of occurrences of violating condi- 
tions, and stores violating condition occurrence 
data arising from operation of the computer sys- 
tem, and records data indicative of existing usage 
of the monitored software; in that the microproces- 
sor control means is coupled to the receiving 
means and to the memory means for determining, 
in response to the usage data, the conditions violat- 
ing said usage limit and for determining whether 
the occurrence of the violating conditions bears a 
predetermined relationship to the established level 
of occurrences of violating conditions; and in that 
the interrupt means is coupled to the computer 
system and to the control means, and is controlled 
by the control means to provide an output to the 
computer system when occurrences of violating 
conditions bear the predetermined relationship to 
the established level of occurrences of violating 
conditions, said output operating to control, in ac- 
cordance with the relationship thus determined, the 
use of the software in the computer system in a 
predetermined manner. 

In a typical application of the device, data not 



significant to security, for example data occunring 
during the ordinary operation of the computer sys- 
tem, pass unimpeded between the central process- 
ing unit and the terminal. When data having signifi- 

5 cance from the security standpoint are sent from a 
tenminal to the central processing unit, the com- 
puter system will interrogate the security device of 
the present invention. Such data might typically be 
a request to run a particular program. The device 

10 has the use limits permitted by the software licence 
programmed into it If the request is proper and 
within the limits established by the software 
licence, operation of the program is permitted. If 
the request is not proper, the security device pro- 

15 duces a variety of consequences. For infrequent 
improper requests, operation of the program may 
be permitted, depending on the applications pro- 
gram, but with an appropriate warning displayed on 
the computer terminal. For frequent improper re- 

20 quests, operation of the program is blocked by the 
security device until released by the software own- 
er or supervisory personnel. 

The device of the present Invention, which is 
independent of the central processing unit, thus 

25 monitors program access requests so as to prop- 
erly control access to the programs in the central 
processing unit 

By contrast to other approaches to program 
security, the device of the present invention is an 

30 intelligent device having interactive capabilities. For 
this purpose, the device may employ a micro- 
processor. The device is readily auditable to as- 
certain which programs are authorised and the 
limits of that authorisation. The device may also 

35 store commercial data relating to the programs, 
such as the name of the software licensee. The 
authorisation can easily be changed in the field 
through a local terminal or through a remote termi- 
nal connected by a modem. Warning messages 

40 and the like provided by the device can be simi- 
larly changed. 

The device may use units, such as cartridges, 
which can be inserted into the device to permit 
control of the authorisation of software application 

46 packages or supplier-designated software products, 
such as word processing or graphics programs. 
This provides increased authorisation control, main- 
tainability, and field reliability. For instance, mul- 
tiple software suppliers can control and maintain 

50 use of their products without coordination with oth- 
er software suppliers in a single computer system. 
This is in contrast to past approaches in which a 
single knowledgeable source of the authorised con- 
figuration must be reached to restore operation of 

55 the computer system following the field failure. 

Embodiments of the invention will now be de- 
scribed, by way of example, with reference to the 
accompanying drawings, in which 
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Rg. 1 is a schematic diagram showing a soft- 
ware protection device of the present invention 
in a computer system having a central process- 
ing unit and one or more terminals; 
Rg. 2 is a schematic diagram showing an alter- 
native connection of the software protection de- 
vice in a computer system; 
Rg. 3 is a schematic block diagram of a soft- 
ware protection device of the present Invention 
connected, as shown in Rg. 1. to the central 
processing unit; 

Rgs. 4A and 4B form a flow chart showing 
operation of the software protection device; 
Rg. 5 is a schematic block diagram showing 
details of the software protection device con- 
nected to a computer system in a manner alter- 
native to Rgs. 1 and 2; 

Rg. 6 is a schematic diagram showing details of 
a software protection device of the present in- 
vention suitable for connection to the computer 
system as shown in Rg. 2; and 
Rg. 7 is a schematic diagram showing use of a 
plurality of security devices of the present inven- 
tion to Increase the number of programs that 
can be protected. 
Refening to Fig. 1, a software protection device 
1 0 of the present invention may be interposed in a 
data signal link or line 12a and I2b between a 
computer terminal 1 4 and a central processing unit 
16 of a computer system. Other terminals 14a, 14b 
may be connected to the central processing unit 
16. For some types of central processing units, a 
second connection between the device 10 and the 
computer 16 may be made by a link or line 18 for 
security purposes because of the particular operat- 
ing system used. The tine 18 is connected to an 
additional peripheral port of the central processing 
unit 16. Altematlvely, the device 10 may be con- 
nected to the central processing unit 16 only via 
the line 18, as shown in Rg, 2. 

The internal configuration of the device 10 is 
shown in Rg. 3. The device 10 shown in Rg. 3 is 
suitable for the connection shown in Fig. 1. The 
data signal line 12a from the terminal 14 is coupled 
to a port 50 of the device 10. The data signal line 
12b, connected to the data port of the central 
processing unit 16, is coupled to a data port 52 of 
the device 10. Internal lines 12' and* 12" intercon- 
nect the ports 50 and 52 to maintain the data signal 
path between the temnlnal 14 and the central pro- 
cessing unit 16. The arrows shown in Rg. 3 sym- 
bolically show the flow of data to and from the 
central processing unit 16 and the temninal 14. The 
line 12" contains signal level shifters 54 and 56 
which alter the signals in the line 12" to levels 
appropriate for the operation of device 10, central 
processing unit 16. and terminal 14. Level shifters 
54 and 56 may comprise integrated circuit RS 232 



level shifters, such as that made and sold by 
National Semiconductor Corp., under the model no. 
1488 or 1489. Line 12" also includes an interrupt 
means 58, shown diagrammaticaliy as a switch 
5 operable by controller 60. Intenrupt means 58 may 
be operated by controller 60 to cause the display 
of warning messages on terminal 14 in certain 
operating modes of the device and to disable data 
signal lines 12a, 12b under certain conditions of 
70 attempted unauthorized use. as described below, 
from the standpoint of passing normal data traffic. 

A second pair of internal data lines 18' and 18" 
are provided in device 10. Lines 18* and 18" are 
connected to port 62 and to security data line 18 
75 leading to the additional peripheral port of central 
processing unit 16. The other ends of lines 18' and 
18" may be connected to port 64 that pennnits 
additional security devices to be connected in se- 
ries with the device shown in Rg. 3, as shown in 
20 Rg. 7. Data line 18' includes signal level shifters 66 
and 68 similar to level shifters 54 and 56. Data line 
18' also includes an interrupt means 70 operable 
by controller 60 to supply infonnation and com- 
mands to the software program in central process- 
as ing unit 16. 

Universal asynchronous receiver-transmitter 72 
has the receiver port connected through level shift- 
er 74 to data line 18". The transmit port is con- 
nected to interrupt means 58 and 70. Receiver- 
30 transmitter 72 may comprise an integrated circuit, 
such as that made and sold by Signetics, as model 
no. SCN26S1. 

Controller 60 may be a microprocessor, such 
as that made and sold by the Motorola Corporation. 
35 of Phoenix, Arizona, under the designation 
MC6809. Watchdog 76 may comprise a monosta- 
ble multivibrator that clocks and resynchronizes 
controller 60 to insure proper operation of controller 
60. 

40 Data bus 78 connects controller 60 to memory 
80. Memory 80 may comprise an electronically 
erasable programmable read only memory 
(EEPROM). Universal asynchronous receiver trans- 
mitter 72 is connected to data bus 78. 

45 Memory 80 contains data relating to the op- 

erating system for central processing unit 16. It 
may also contain the data maintenance and operat- 
ing programs for device 10, as well as a map of the 
data contained in cartridges 82 hereinafter de- 

50 scribed. 

Data relating to the programs authorized to run 
on the computer system 14-16 is contained in 
plug-in cartridges 82a. 82b. and 82c. These plug-in 
cartridges may each comprise an electronically 

55 erasable programmable read only memory 
(EEPROM) containing data specific to a particular 
vendor. The EEPROM contains the limits of au- 
thorization for the various programs and packages 
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contained in central processing unit 16. A map of 
the data in the cartridge is also included in the 
EEPROM. The cartridges are connected to control- 
ler 60 by data bus 84. 

Device 10 operates as follows, as shown in 
flow chart form in Rg. 4. Device 10 monitors line 
18 from the security port of central processing unit 
16 as at step 100 in Fig. 4 to ascertain the pres- 
ence of information significant to program security. 
Thus, when a request from terminal 14 to central 
processing unit 16, via the applications software 
program in central processing unit 16. requests 
authorization to run a particular program, the ap- 
plication software in central processing unit 16 will, 
in turn, issue a request in security lines 18 to 
device 10 as at step 102 to inquire whether running 
of the program is authorized. The request will be 
received by universal asynchronous receiver-trans- 
mitter 72 and provided to controller 60. Controller 
60 through data bus 84 will Interrogate the ap- 
plicable cartridge 82 to obtain the authorization 
data relating to the requested program, as at step 
104. If the request is within the authorization pro- 
vided in the software license, controller 60 will 
provide a response through receiver-transmitter 72 
in data bus 18*. 18" to the associated port of 
central processing unit 16 indicating to the com- 
puter system that operation of the program is au- 
thorized. The program is then permitted to run. 
This is shown in Fig. 4 as step 106. 

If the analysis of the request for program au- 
thorization at step 104 indicates that the request is 
not within authorized limits, the following operation 
will occur. The applicable cartridge 82 contains 
data relating to the number of unauthorized re- 
quests for the program; the time of the last un- 
authorized request: and a moving average of the 
frequency of unauthorized requests. This data is 
interrogated by controller 60 via data bus 84 at 
steps 107, 108. and 110 of Fig. 3. At the same time 
the stored data is updated at steps 112, 114. and 
116. Computation of the moving average may em- 
ploy an exponential smoothing function in which 
latter entries may be related to earlier entries in a 
desired manner to reflect the number of incidents 
of significance in the average. 

Based on the frequency at which unauthorized 
requests are occurring, one of four events will 
occur in protective device 10. The frequency levels 
at which the various events will occur are pro- 
grammed into cartridges 82 by the software sup- 
plier. 

A very low frequency of unauthorized requests 
indicates that the unauthorized requests are prob- 
ably occurring through Inadvertency or genuine er- 
ror. For example, a terminal operator may inadver- 
tently request the wrong program. Or. the correct 
program may be requested but at the wrong time. 



If the frequency of unauthorized request is less 
than some predetermined number A programmed 
into the applicable cartridge 82, as detennined in 
step 118 of Hg. 4. an error message is sent to 
5 central processing unit 16 from protective device 
10 at step 119 for whatever further action may be 
undertaken by the applications software. The mes- 
sage will be provided from receiver-transmitter 72. 
as controlled by controller 60, and inten'upt device 
70 70. The message indicates that a violation has 
occurred but that it is a low level violation. This 
may be termed a Level I violation. The applications 
software will typically provide a warning on the 
operator's terminal screen 14. Other typical action 
75 that could be taken by the application software 
might include entry in a master log in central 
processing unit 16 or the provision of a warning 
signal to a supervisory terminal connected to cen- 
tral processing unit 16. Normally the application 
20 software would be permitted to run after the appro- 
priate warning signal has been recorded and/or 
given, as shown in Rg. 4. For infrequent violations, 
it will be appreciated that the operation of device 
10 is basically open loop. Messages are sent to 
25 central processing unit 16 but no other action is 
taken by device 10. 

If the unauthorized requests are occurring at a 
greater frequency, this may be taken as evidence 
that some deliberate attempt is being made to 
30 obtain unauthorized access to the programs in cen- 
tral processing unit 16. Step 120 in the flow chart 
of Fig, 4 ascertains that the frequency of un- 
authorized requests is greater than the threshold A 
of step 118 but less than some greater frequency 
35 B also programmed into the applicable cartridge 
82. This may be tenmed a Level II violation. Under 
this circumstance, an error message is sent to the 
application software in central processing unit 16, 
as at step 121, similar to the action 119 taken for 
40 low frequency violations. However, additionally, a 
timer provided in controller 60 is set in operation as 
at step 123. If security device 10 does not receive 
an appropriate response from the software In cen- 
tral processing unit 16. within the time period of the 
45 timer as at step 125 receiver-transmitter 72 pro- 
vides a signal in line 18 from interrupt device 70 to 
disable that particular piece of software from run- 
ning in central processing unit 16 as at step 127. 
The computer system can run other software for 
so which authorization is not required or for which 
authorization is property obtained. 

If the software in central processing unit does 
provide the appropriate response to protection de- 
vice 10 witiiin the time period of tiie timer, tiie 
55 software is permitted to run in the same manner as 
described in connection with step 118. The addi- 
tional action discussed above would ordinarily be 
taken, such as a warning on terminal screens, entry 
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in master logs, and the like. The operation of 
device 10 just described is closed loop in that a 
response, or lack thereof, from central processing 
unit 16 back to device 10 is involved in the opera- 
tion. 5 

If the violation frequency is greater than the 
threshold provided in step 120 but less than some 
higher threshold C. as determined in step 122 
shown in the flow chart of Rg. 4. receiver-transmit- 
ter 72 and controller 60 operate interrupt device 70 io 
that acts directly on central processing unit 16 to 
disable the program, as at step 124. Receiver- 
transmitter 72 and controller 60 also operates inter- 
rupt device 58 to send a disable message directly 
from device 10 to terminal 14. as at step 129. This is 
is a Level III violation. 

For Level ill violations, operation of the com- 
puter system can only be restored or released by 
the insertion of a key sequence from computer 
terminal 14 to controller 60 or cartridge 82 as at 20 
step 126. This could be done by the user's su- 
pervisory personnel. Or it could be done by a field 
service representative of the program supplier, ei- 
ther locally through user's terminal 14 or remote 
from terminal of the supplier connected by a 25 
modem. 

It should be noted that, at violation Level 111, the 
operation of protection device 10 does not depend 
on the application software in central processing 
unit 16. Rather, protection device 10 operates in- 30 
dependently on central processing unit 16 to dis- 
able operation of the protected software. 

For very, very frequent violations greater than 
frequency C, that can only indicate deliberate at- 
tempts to secure unauthorized access to the pro- 35 
gram, protection device 10 again disables the pro- 
gram in the same manner as described in the 
preceding paragraph as at step 128. However, pro- 
tection device 10 will only restore operation of the 
protected software by a key sequence inputted to 40 
controller 60 from the program supplier's factory, 
as through a modem connected either to central 
processing unit 16 or protective device 10 or from 
terminal 14, as at step 130. This is termed a Level 
IV violation. ^ 

Data relating to the number of unauthorized 
requests and the time they are occurring indicated 
at steps 114 and 116 in Rg. 4 may be used to 
assist in detecting the source of the unauthorized 
requests. s° 

In a usual embodiment of software protection 
device 10. the typical data shown in the following 
data table would be provided in each cartridge 82. 
It is anticipated that each cartridge 82 could typi- 
cally be of sufficient storage capacity for the data 55 
relating up to approximately one hundred software 
packages. The data table is as follows. 
1. Cartridge Related Data 



A. Serial number of cartridge 

B. Cartridge modification count 

C. Cartridge Shipping date 

D. Last cartridge update 

E. Date that software authorization will termi- 
nate 

F. Date of warning of impending temiination 

G. Run hours warning 

H. Cartridge maintenance data 

1. Access validation data (validates access 
to cartridge data) 

2. Modification validation data (validates 
modification) 

I. Warning messages text 

J. Owner of software license 
K. Software reseller No. 1 
L, Software reseller No. 2 
II. Software Package related data. 

A. Identification of software package 

B. Authorization data 

1 . Demonstration package? 

2. Non-demonstration package 

a. terminals allowed for this software 
package 

b. number of currently active terminals 

c. number of terminals authorized 

C. Detection data 

1 . Criteria 

a. level required for warning 

b. level required for timed disable 

c. level required for terminal released 
disable 

d. level required for cpu released dis- 
able 

2. Occun-ence data 

a. number of violations 

b. time of last violation 

c. moving average of frequency of vio- 
lations 

The foregoing data table provides the data 
necessary for operation of the protective system, 
as well as the necessary control information to the 
software supplier. 

As will be noted from the data table, cartridges 
82 may be reprogrammed from terminal 14 to alter 
the limits of authorization. For example, in return 
for increased payments, the limits of authorization 
can be expanded. Any such changes require prop- 
er validation and modification access data or pass- 
words. 

The application software may be transferred to 
another central processing unit by transferring both ' 
the software and protection device 10 or, at least 
the appropriate cartridge 82. However, if transfer of 
the software is attempted without the cartridge 82, 
the software cannot be made to run. 

Rg. 5 shows a device 10A of the present 
invention suitable for use with a computer system 
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having only a single data line 12 for botli data and 
security information. The configuration of device 
10A generally resembles that of device 10 as 
shown in Rg. 2. Interrupt means 58 is connected in 
data signal line 12 to disable operation of the 
software and provide messages from receiver- 
transmitter 72 to the screen of terminal 14. 

Rg. 6 shows a device 10B of the present 
invention suitable for operating solely through the 
associated additional peripheral port of central pro- 
cessing unit 1 6. All warning and interrupt messages 
are transmitted through this port of the central 
processing unit via the line 18. 

Rg. 7 schematically shows use of a plurality of 
software protection devices 10-1. 10-2 and the as- 
sociated inten-upt devices 58 and 70 between ter- 
minal 14 and central processing unit 16. Protection 
devices 10-1 and 10-2 are connected in series on 
security line 18 and/or. if applicable, on data signal 
line 12. The use of additional protection devices 10 
Increases the number of software packages that 
can be protected. 

Claims 

1, Apparatus (10) for monitoring the use of soft- 
ware in a computer system with respect to at 
least one selected aspect of such use. the 
computer system having a central processor 
(16) containing the software, the central pro- 
cessor (16) being accessed by at least one 
operator terminal (14) connected to the central 
processor; the apparatus (10) comprising re- 
ceiving means (72) coupled to the central pro- 
cessor (1 6), memory means (82) for containing 
data establishing the software usage limit for 
the selected aspect, microprocessor control 
means (60). and interrupt means (58.70); 
characterised in that the software in the central 
processor (16) generates usage data indicative 
of monitored software usage for the selected 
aspect of the computer system, the apparatus 
employing at least one pre-established level of 
occunrences of conditions violating the usage 
limit for the selected aspect when monitoring 
use of the software; in that the receiving 
means (72) is coupled to the central processor 
(1 6) for receiving the monitored software usage 
data from software in the central processor; in 
that the memory means (82) contains data 
establishing the pre-established level of occur- 
rences of violating conditions, and stores vio- 
lating condition occurrence data arising from 
operation of the computer system, and records 
data indicative of existing usage of the mon- 
itored software; in that the microprocessor con- 
trol means (60) is coupled to the receiving 
means (72) and to the memory means (82) for 



determining. In response to the usage data, the 
conditions violating said usage limit and for 
determining whether the occurrence of the vio- 
lating conditions bears a predetemnlned rela- 

5 tionship to the established level of occurrences 

of violating conditions; and in that the internjpt 
means (58,70) is coupled to the computer sys- 
tem and to the control means (60), and is 
controlled by the control means to provide an 

10 output to the computer system when occur- 
rences of violating conditions bear the pre- 
determined relationship to the established level 
of occurrences of violating conditions, said out- 
put operating to control, in accordance wttii tiie 

15 relationship thus determined, the use of the 

software in the computer system in a predeter- 
mined manner. 

2. Apparatus according to claim 1 for restricting 
20 the use of monitored software in a computer 

system in accordance with a usage limit estab- 
lished for a number of permitted concunrent 
usages of the monitored software, the central 
processor (16) being accessed by at least two 
25 operator terminals (14) connected to the cen- 

tral processor, wherein the memory means 
(82) contains data establishing the software 
usage limit for the number of concun-ent us- 
ages of the monitored software and records 
30 data indicative of the concurrent usages of the 

monitored software. 

3- Apparatus according to claim 1 or claim 2. 
wherein the interrupt means (58,70) provides 
35 an output to the computer system for restrict- 

ing use of the monitored software, 

4. Apparatus according to claim 2, wherein tiie 
concurrent use is evidenced by the number of 

40 operator terminals concurrently using the mon- 

itored software and wherein the apparatus re- 
stricts use of the monitored software in accor- 
dance with a usage limit established for the 
number of operator terminals (14) permitted to 

45 concurrentiy use the monitored software. 

5. Apparatus according to any preceding claim, 
wherein the memory means (82) contains data 
establishing at least two violative condition oc- 

50 currence levels. 

6. Apparatus according to any of claims 1 to 4 
. further defined as employing at least two pre- 
established levels of occurences of conditions 

55 violative of the usage limit for the selected 

aspect, wherein the memory means (82) con- 
tains data establishing violative condition oc- 
currence levels and wherein the control means 
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(60) is set to a first state that permits use of 
the monitored software in the central processor 
(16) or to a second state that restricts use of 
the monitored software, the control means (60) 
changing from the first state to the second 
state when the occurrence of violative con- 
ditions bears a predetermined relationship to a 
violative condition occun-ence level, the control 
means (60) being capable of being reset from 
the second state to the first state by remotely 
generated resetting instructions, and wherein 
the interrupt means (58,70) provides an output 
to the computer system when the control 
means (60) is in the second state for restricting 
use of the monitored software. 

7. Apparatus according to any preceding claim, 
wherein the control means (60) and interrupt 
means (58,70) provide a signal indicating im- 
proper usage requests to the software in the 
central processor (16) upon the existence of a 
first occurrence level. 

8. Apparatus according to any preceding claim 
wherein the control means (60) and inten-upt 
means (58,70) prevent the monitored software 
from operating in the central processor (16) 
upon the existance of a second occurrence 
level. 

9. Apparatus according to any preceding claim, 
wherein the memory means (82) contains data 
establishing levels in the frequency of violative 
condition occurrences. 

10. Apparatus according to claim 9, further com- 
prising timing means in the control means (60) 
operable when the frequency of a violative 
condition occurence exceeds a predetermined 
level and requiring a timely response from the 
central processor (16) to avoid operating the 
intermpt means (58,70). 

11. Apparatus according to claim 10, wherein the 
timing means have a predetermined timing in- 
terval, the timing means commencing a timing 
interval when the frequency of a violative con- 
dition occurrences exceeds a pre-established 
level, the control means (60) and interrupt 
means (58,70) providing a signal to the soft- 
ware in the central processor (16) indicating 
commencement of the timing interval and pro- 
viding a signal preventing the monitored soft- 
ware from operating in the central processor 
(16) unless a response is received from the 
central processor within the timing inten^al of 
the timer. 



12. Apparatus according to any of the preceding 
claims wherein the control means (60) is set to 
a first state that permits use of software in the 
central processor (16) or to a second state that 

5 restricts use of software, and wherein the con- 

trol means (60) can be reset from the second 
state to the first state. 

13. Apparatus according to any preceding claim, 
70 further including transmitter means coupled to 

the control means and to the interrupt means 
for transmitting warning signals generated by 
the control means to the central processor. 

75 14. Apparatus according to any one of claims 1 to 

12. wherein the interrupt means is coupled to. 
at least one operator terminal, the apparatus 
further including transmitter means (72) coup- 
led to the control means and to the interrupt 

20 means for transmitting warning signals gen- 

erated by the control means to at least one of 
the the operator terminal and central proces- 
sor. 

25 15- Apparatus according to any preceding claim 
whereirr the interrupt means (58,70) is coupled 
to the central processor (16) by means of a 
data signal link (12) and wherein the receiver 
means (72) is coupled to the data signal link 

30 (12). 

16. Apparatus according to any one of claims 1 to 

13, wherein the central processor of the com- 
puter system has a security signal link (18) 

35 and wherein the interrupt means (58,70) and 

receiver means are coupled to the security 
signal link (18) of the central processor (16). 

17. Apparatus according to any one of claims 1 to 
40 13, wherein the central processor (16) of the 

computer system has a security signal link (18) 
and has a data signal link (12), wherein the 
interrupt means includes means (58) coupled 
to the data signal link (12) and means (70) 
45 coupled to the security signal link (18), and 

wherein the receiving means is coupled to the 
security signal link. 

18. Apparatus according to claim 16 or claim 17, 
50 wherein the transmitter means (72) are coupled 

to the security signal link. 

19. Apparatus according to claim 18, wherein the 
transmitter means is connected to the data 

55 signal link. 

20. Apparatus according to any preceding claim, 
wherein the memory means (82) is contained 
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in an element removable from the apparatus. 

21. Apparatus according to any preceding claim, 
wherein the memory means (82) further com- 
prises programmable memory means In which 5 
the data of the memory means may be altered. 

22. Apparatus according to claim 21. wherein the 
memory means (82) comprises an EEPROM. 

70 

23. Apparatus according to any preceding claim, 
wherein the central processor (16) of the com- 
puter system has an operating system and 
wherein the apparatus further includes addi- 
tional memory means (80) coupled to the con- 75 
trol means containing data relating to the op- 
erating system of the central processor (16). 

24- Apparatus according to claim 20, wherein the. 
additional memory means (80) comprises an 20 
EEPROM. 

25. Apparatus according to any preceding claim, 
wherein the receiving means and the interrupt 
means (72) include means for connecting an 25 
additional software use monitoring apparatus in 
series therewith, the apparatus further includ- 
ing a plurality of software monitoring ap- 
paratuses connected in series for monitoring 
additional software in the computer system. 30 

Revendications 

1, Dispositif (10) pour controler Temploi d'un logi- 

ciel dans un systeme de traitement de llnfor- 35 
mation en ce qui concerne au mbins un aspect 
seiectionne de cet emploi, le systeme de trai- 
tement de IMnformation comportant un prpces- 
seur central (16) contenant le logiciel, I'acces 
etant fait au processeur central (16) par au 40 
moins un terminal d*operateur (14) connecte 
au processeur central; le dispositif (10) com- 
prenant un moyen recepteur (72) couple au 
processeur central (16), un moyen a memoire 
(82) pour contenir des .donnees etablissant la 46 
limite d'usage du logiciel pour Taspect seiec- 
tionne, un moyen controleur a microproces- 
seur (60), et un moyen interrupteur (58.70); 
caracterise en ce que te logiciel Indus dans le 
processeur central (16) genere des donnees so 
d'usage indiquant un usage du logiciel contro- 
le pour raspect s6lectionne du systfeme de 
traitement de Tinfonnnation, le dispositif mettant 
en oeuvre au moins un niveau preetabli d'ap- 
paritions de conditions violant la limite d'usage 55 
pour raspect seiectionne pendant un contr6le 
de remploi du logiciel; en ce que le moyen 
recepteur (72) est couple au processeur cen- 



tral (16) pour recevoir les donnees d'usage du 
logiciel controle en provenance du logiciel In- 
dus dans le processeur central; en ce que le 
moyen a memoire (82) contient des donnees 
etablissant le niveau preetabli d'apparitions de 
conditions de violation, et memorise des don- 
nees d'apparition de conditions de violation 
resultant du fonctionnement du systeme de 
traitement de Tinformation, et enregistre des 
donnees indiquant Tusage existant du logiciel 
control^; en ce que le moyen controleur a 
microprocesseur (60) est couple au moyen re- 
cepteur (72) et au moyen h memoire (82) pour 
detenminer, en reponse aux donnees d'usage, 
les conditions violant ladite limite d'usage et 
pour determiner si Tapparition des conditions 
de violation comporte un rapport predetermine 
vis-a-vis du niveau etabli d'apparitions de 
conditions de violation; et en ce que le moyen 
interrupteur (58,70) est coupl6 au systeme de 
traitement de Tinformation et au moyen contrd- 
leur (60), et est command^ par le moyen 
controleur pour fournir un signal de sortie au 
systlme de traitement de Tinformation quand 
les apparitions de conditions de violation com- 
portent un rapport predetermine vis-a-vis du 
niveau etabli d'apparitions de conditions de 
violation, ledit signal de sortie agissant pour 
commander, selon le rapport ainsi determine, 
I'emploi du logiciel dans le systeme de traite- 
ment de I'information d'une maniere predeter- 
minee. 

2. Dispositif selon la revendication 1, pour limiter 
remploi du logiciel controle dans un systeme 
de traitement de rinformatlon confomnement a 
une limite d'usage etablie pour un certain nom- 
bre d'usages concurrents admis du logiciel 
controle, Tacces au processeur central (16) 
etant fait par au moins deux terminaux d'ope- 
rateur (14) connect^s au processeur central, 
dans lequel le moyen a memoire (82) contient 
des donnees etablissant la limite d'usage du 
logiciel pour !e nombre d'usages concunrents 
du logiciel controle et enregistre des donnees 
indiquant les usages concun-ents du logiciel 
controle. 

3. Dispositif selon Tune quelconque des revendi- 
cations 1 et 2, dans lequel le moyen intenrup- 
teur (58,70) fournit un signal de sortie au sys- 
teme de traitement de I'information pour limiter 
I'empioi du logiciel controle. 

4. Dispositif selon la revendication 2, dans lequel 
I'empioi concurrent est mis en evidence par le 
nombre de terminaux d'operateur employant 
en concurrence le logiciel controle et dans 
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lequel le dispositif iimite I'emploi du logiciel 
control^ confomn^ment a une iimite d'usage 
etablie pour le nombre de terminaux d'opera- 
teur (1 4) admis a employer en concurrence le 
logiciel controls. 5 

5. Dispositif seion Tune quelconque des revendi- 
cations 1 a 4, dans lequel le moyen a memoi- 
re (82) contient des donnees etabilssant au 
moins deux niveaux d'apparition de conditions to 
de violation. 

6. Dispositif seion I'une quelconque des revendi- 
cations 1 a 4. defini en outre comme mettant 

en oeuvre au molns deux niveaux preetablis is 
d'apparitions de conditions violant la iimite 
d'usage pour Taspect seiectionne, dans lequel 
le moyen a memoire (82) contient des don- 
nees etablissant des niveaux d'apparition de 
conditions de violation et dans lequel le moyen 20 
controleur (60) est mis k un premier etat qui 
permet I'emploi du logiciel contrdle dans le 
processeur central (16) ou ^ un second etat 
qui Iimite Temploi du logiciel control^, le 
moyen controleur (60) passant du premier etat 25 
au second etat quand rapparltion de conditions 
de violation comporte un rapport predetermine 
vis-a-vis d'un niveau d'apparltion de conditions 
de violation, le moyen controleur (60) pouvant 
etre remis du second etat au premier etat par 30 
des Instructions de remise a i'etat initial gene- 
rees k distance, et dans lequel le moyen inter- 
rupteur (58,70) fournit un signal de sortie au 
systeme de traitement de IMnformation quand 
le moyen controleur (60) est dans le second 35 
etat pour limiter Temploi du logiciel controle. 

7. Dispositif seion Tune quelconque des revendi- 
cations 1 a 6, dans lequel le moyen controleur 

(60) et le moyen interrupteur (58.70) foumis- 40 
sent un signal indiquant des demandes d'usa- 
ge incon-ectes au logiciel incius dans le pro- 
cesseur central (16) au cours de rexistence 
d*un premier niveau d*apparition. 

45 

8. Dispositif seion Tune quelconque des revendi- 
cations 1 a 7. dans lequel le moyen controleur 
(60) et le moyen intenupteur (58,70) empe- 
Ghent le logiciel controle d'agir dans le proces- 
seur central (16) au cours de Texistence d'un 50 
deuxi&me niveau d'apparition. 

9. Dispositif seion Tune quelconque des revendi- 
cations 1 ^ 8. dans lequel le moyen a memoi- 
re (82) contient des donnees etablissant des 55 
niveaux dans la frequence des apparitions de 
conditions de violation. 



10, Dispositif seion la revendication 9, comprenant 
en outre un moyen de synchronisation dans le 
moyen controleur (60) pouvant fonctionner 
quand la frequence d'apparition de conditions 
de violation depasse un niveau predetermine 
et exigeant une reponse synchronisee du pro- 
cesseur central (16) pour eviter le fonctionne- 
ment du moyen interrupteur (58,70). 

11, Dispositif seion la revendication 10, dans le- 
quel le moyen de synchronisation comporte un 
intervalle de synchronisation predetermine, le 
moyen de synchronisation commengant un in- 
tervalle de synchronisation quand la frequence 
d'apparition des conditions de violation depas- 
se un niveau preetabli. le moyen controleur 
(60) et le moyen interrupteur (58,70) foumis- 
sant un signal au logiciel incius dans le pro- 
cesseur central (16) indiquant le commence- 
ment de rintervalle de synchronisation et four- 
nissant un signal emp§chant le logiciel contro- 
le d'agtr dans le processeur central (16) a 
moins qu'une reponse soit regue du proces- 
seur central dans Tintervalle de synchronisa- 
tion du moyen de synchronisation. 

12, Dispositif seion Tune quelconque des revendj- 
catlons 1 ^ 11, dans lequel le moyen contro- 
leur (60) est mis a un premier etat qui permet 
I'empioi du logiciel dans le processeur central 
(16) ou a un second etat qui Iimite I'emploi du 
logiciel, et dans lequel le moyen controleur 
(60) peut etre remis du second etat au premier 
etat. 

13, Dispositif seion I'une quelconque des revendi- 
cations 1 k 12, incluant en outre un moyen 
emetteur couple au moyen controleur et au 
moyen Inten-upteur pour emettre des signaux 
d'avertissement engendres par le moyen 
controleur vers le processeur central. 

14, Dispositif seion Tune quelconque des revendi- 
cations 1 Si 12, dans lequel le moyen interrup- 
teur est coupie a au moins un terminal d'ope- 
rateur. le dispositif incluant en outre un moyen 
emetteur (72) couple au moyen controleur et 
au moyen intenupteur pour emettre des si- 
gnaux d'avertissement engendres par le 
moyen controleur vers au moins un du tenni- 
nal d'operateur et du processeur central. 

15, Dispositif seion Tune quelconque des revendi- 
cations 1 a 14, dans lequel le moyen interrup- 
teur (5870) est couple au . processeur central 
(16) au moyen d'une liaison pour signaux de 
donnees (12) et dans lequel le moyen recep- 
teur (72) est coupie a la liaison pous signaux 
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de donnees (12). 

16. Dispositif seion Tune quelconque des revendi- 
cations 1 a 13. dans lequei le processeur 
central du systeme de traitement de Tinforma- 5 
tion comporte une liaison pour signaux de se- 
curite (l 8) et dans lequei le moyen interrupteur 
(58,70) et le moyen recepteur sent couples k 

la liaison pour signaux de securite (18) du 
processeur central (1 6). io 

17. Dispositif selon I'une quelconque des revendi- 
cations 1 a 13. dans lequei le processeur 
central (16) du syst&me de traitement de Tin- 
formation comporte une liaison pour signaux )5 
de securite (18) et comporte une liaison pour 
signaux de donnees (12), dans lequei le 
moyen interrupteur comprend un moyen (58) 
couple a la liaison pour signaux de donnees 

(12) et un moyen (70) couple a la liaison pour 20 
signaux de securite (18), et dans lequei le 
moyen recepteur est couple a ia liaison pour 
signaux de securite. 

18. Dispositif selon Tune quelconque des revendi- 25 
cations 16 et 17, dans lequei le moyen emet- 

teur (72) est coupl6 h ia liaison pour signaux 
de security. 

19. Dispositif selon la revendication 18. dans le- 30 
quel le moyen emetteur est connect^ a la 
liaison pour signaux de donnees. 

20. Dispositif seion Tune quelconque des revendi- 
cations 1 a 19, dans lequei le moyen a me- 35 
moire (82) est contenu dans un element amo- 
vible du dispositif. 

21. Dispositif selon Tune quelconque des revendi- 
cations 1 a 20, dans lequei le moyeri a me- 40 
moire (82) comprend en outre un moyen a 
memoire programmable dans lequei les don- 
nees du moyen a memoire peuvent §tre modi- 
fiees. 

46 

22. Dispositif selon la revendication 21, dans le- 
quei le moyen a memoire (82) comprend une 
memoire morte programmable effagable elec- 
triquement (EEPROM). 

50 

23. Dispositif selon Tune quelconque des revendi- 
cations 1 a 22. dans lequei le processeur 
central (16) du systfeme de traitement de Tin- 
formation comporte un syst&me d'exploitatlon 

et dans lequei le dispositif inclut en outre un ss 
moyen ^ memoire suppl^mentaire (80) couple 
au moyen contr6leur contenant des donnees 
relatives au systeme d*exploitation du proces- 



seur central (16). 

24- Dispositif selon la revendication 20, dans le- 
quei le moyen k memoire supplementaire (80) 
comprend une memoire EEPROM. 

25. Dispositif selon Tune quelconque des revendi- 
cations 1 k 24, dans tequel le moyen recepteur 
et le moyen interrupteur (72) comprennent des 
moyens pour connecter un dispositif de 
controle de Temploi d'un logiciel supplemen- 
taire en serie avec ceux-ci. le dispositif in- 
cluant en outre un ensemble de dispositifs de 
controle de logiciel connectes en serie pour 
controler le logiciel supplementaire dans le 
systeme de traitement de Tinformation. 

Patentanspruche 

1. Vorrichtung (10) zum QberprOfen der Verwen- 
dung einer Software in einem Computersystem 
bezuglicli wenigstens einem ausgewahiten 
Verwendungsaspekt, wobei das Computersy- 
stem einen Zentralprozessor (16) mit der Soft- 
ware aufweist sowte mindestens eine mit dem 
Zentralprozessor verbundene Bedienungs-Da- 
tenstation (14). die zugriff auf den Zentralpro- 
zessor hat. und wobei die Vorriclitung (10) ein 
mit dem Zentralprozessor (16) verbundenes 
Empfangsmittel (72) hat, ein Speichermittel 
(82). das Daten, die die Software-Venven- 
dungsgrenze fur den ausgewahiten Aspekt be- 
grOnden, enthalt sowie ein Mikroprozessor- 
Steuermittel (60) und ein Unterbrechungsmittel 
(58, 70), dadurch gekennzeichnet, daj3 die 
Software in dem Zentralprozessor (16) Verwen- 
dungsdaten erzeugt. die fOr die GberprOfte 
Software-Verwendung fOr den ausgewahiten 
Aspekt des Computersystems bezeichnend 
sind, wobei die Von'ichtung. wenn die Verwen- 
dung der Software uberprtift wird, wenigstens 
ein voreingestelltes Niveau von Vorkommen 
von Bedingungen benutzt. die die Verwen- 
dungsgrenze fOr den ausgewahiten Aspekt ver- 
letzen; dafi das Empfangsmittel (72) mit dem 
Zentralprozessor (16) verbunden ist zum Emp- 
fang der uberprCften Software-Venwendungs- 
daten von der Software in den Zentralprozes- 
sor; dafl das Speichermittel (82) Daten enthalt, 
die das voreingestellte Niveau von Vorkommen 
von verletzenden Bedingungen etablleren, und 
das Speichermittel die verletzenden 
Bedingungsvorkommen-Daten. die mit dem 
Betrieb des Computersystems entstehen, spei- 
chert sowie die Daten abspeichert, die fOr die 
bestehende Verwendung der Oberpruften Soft- 
ware bezeichnend sind; dafi das 
Mikroprozessor-Steuermittei (60) mit dem 
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Empfangsmittel (72) und dem Speichermittel 
(82) verbunden ist, urn in Reaktion auf die 
Verwendungsdaten die Bedingungen zu be- 
stimmen. die die Verwendungsgrenze verlet- 
zen, und zur Bestimmung, ob das Vorkommen 5 
der verletzenden Bedingungen einen Bezug 
hat auf eine vorbestimmte Bezieinung zu dem 
aufgesteliten Niveau von Vorkommen von ver- 
letzenden Bedingungen; und daiS das Unter- 
brechungsmittel (58. 70) mit dem Computersy- 
stem und dem Steuermittel (60) verbunden ist 
und von dem Steuermittel gesteuert wird, um 
eine Ausgabe an das Computersystem zu 
schaffen, wenn die Vorkommen der verletzen- 
den Bedingungen einen Bezug haben auf die is 
vorbestimmte Beziehung zu dem aufgesteliten 
Niveau der Vorkommen von verletzenden Be- 
dingungen, wobei die Ausgabe so arbeitet, dai3 
gema/3 der so bestimmten Beziehung die Ver- 
wendung der Software in dem Computersy- 20 
stem in einer vorbestimmten Weise gesteuert 
wird. 

2, Vorrichtung nach Anspnjch 1 fOr die Ein- 
schrankung der Venwendung der uberprOften 25 
Software in ' einem Computersystem entspre- 
chend einer Verwendungsgrenze, die fQr eine 
Anzahl von erlaubten, gleichzeitigen Verwen- 
dungen der QberprOften Software errlchtet ist, 
wobei auf den Zentralprozessor (16) wenig- ao 
stens zwei Bedienungs-Datenstationen (14) 
Zugriff haben, worin das Speichermittel (82) 
Daten enthait. die die Software-Venwendungs- 
grenze fur eine Anzahl von gleichzeitigen Ver- 
wendungen der uberprOften Software begrOn- 3S 
den. und Daten speichert. die fOr die gleichzei- 
tigen Venwendungen der UberprOften Software 
bezeichnend sind. 

3. Vorrichtung nach Anspruch 1 Oder Anspruch 2, 40 
worin das Unterbrechungsmittel (58, 70) eine 
Ausgabe an das Computersystem schafft, um 

die Verwendung der uberprOften Software zu 
beschranken. 

45 

4. Vonrichtung nach Anspruch 2. worin die gleich- 
zeitige Verwendung an der Zahl der 
Bedienungs-Datenstationen erkennbar ist. die 
gieichzeitig die uberprOfte Software benutzen. 

und worin die Vorrichtung die Verwendung der so 
uberprOften Software beschrSnkt gemafi einer 
Verwendungsgrenze, die fUr die Zahl der 
Bedienungs-Datenstationen (14) errlchtet ist, 
welche gieichzeitig die OberprOfte Software be- 
nutzen dOrfen. 55 

5, Vorrichtung nach einem der vorangehenden 
Anspruche, worin das Speichermittel (82) Da- 



ten enthait, die wenigstens zwei Niveaus von 
verletzenden Bedingungsvorkommen begrOn- 
den. 

6. Vorrichtung nach einem der AnsprOche 1 bis 4 
und femer definiert durch die Ven/vendung von 
wenigstens zwei voreingestellten Niveaus von 
Vorkommen von Bedingungen, die die Verwen- 
dungsgrenze fOr den ausgewahlten Aspekt ver- 
letzen, worin das Speichermittel (82) Daten 
enthait, die Niveaus von verletzenden Bedin- 
gungsvorkommen begrOnden. und worin das 
Speichermittel (60) auf einen ersten Zustand 
eingesteilt Ist. der die Verwendung der Ober- 
pruften Software in dem Zentralprozessor (16) 
erlaubt, oder auf einen zweiten Zustand, der 
die Verwendung der OberprOften Software be- 
schrankt. wobei die Steuervorrichtung (60) von 
dem ersten in den zweiten Zustand wechselt, 
wenn das Vorkommen von verletzenden Bedin- 
gungen einen Bezug hat auf eine vorbestimm- 
te Beziehung zu einem Niveau von verletzen- 
den Bedingungsvorkommen. und das Steuer- 
mittel (60) von dem zweiten Zustand in den 
ersten Zustand durch femerzeugte RUcksetzin- 
struktlonen zurOckversetzt werden kann, und 
worin das Unterbrechungsmittel (58, 70) eine 
Ausgabe an das Computersystem schaffl, 
wenn das Steuermittel (60) in dem zweiten. 
Zustand ist zur Beschrankung der Verwendung 
der UberprOften Software. 

7. Vorrichtung nach einem der vorangehenden 
AnsprOche. worin das Steuermittel (60) und 
das Unterbrechungsmittel (58, 70) bel Voriie- 
gen eines ersten Vorkommennlveaus ein Si- 
gnal schafft, das eine falsche Verwendungsan- 
frage an die Software in dem Zentralprozessor 
(16) anzeigt. 

a Von-ichtung nach einem der vorangehenden 
AnsprOche, worin das Steuermittel (60) und 
das Unterbrechungsmittel (58. 70) bei Vorlie- 
gen eines zweiten Vorkommennlveaus die 
UberprOfte Software daran hindert in dem Zen- 
tralprozessor (16) zu arbeiten. 

9. Vorrichtung nach einem der vorangehenden 
AnsprOche, worin das Speichermittel (82) Da- 
ten enthait, die Niveaus in der Frequenz von 
verletzenden Bedingungsvorkommen begrOn- 
den. 

10. Vorrichtung nach Anspruch 9, die femer in 
dem Steuermittel (60) ein Zeltmittel aufwelst, 

. das betriebsfahig ist, wenn die Frequenz eines 
verletzenden Bedingungsvori<ommens ein vor- 
bestimmtes Niveau Oberschreitet, und die eine 
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Zeitantwort aus dem Zentraiprozessor (16) be- 
nStigt. um den Betrieb des Unterbrechungsmit- 
tels {58. 70) zu vermeiden. 

11. Vorrichtung nach Anspruch 10, worin das Zeit- 
mittei ein vorbestimmtes Zeitintervall hat wo- 
bei das Zeitmittel ein Zeitintervall startet, wenn 
die Frequenz von verletzenden Bedingungsvor- 
kommen ein vorbestimmtes Niveau uberschrei- 
tet wobei das Steuermitte! (60) und das Unter- 
brechungsmittel (58, 70) ein Signal an die Soft- 
ware in dem Zentraiprozessor (16) bereitstellt. 
das den Start des Zeitlntervalls anzeigt, und 
ein Signal schafftt das den Betrieb der Qber- 
pruften Software in dem Zentraiprozessor (16) 
verhindert bis eine Antwort von dem Zentrai- 
prozessor innerhalb des Zeitintervalls des Zeit- 
gebers empfangen wird. 

1Z Vorrichtung nach einem der vorangehenden 
AnsprOche, worin das Steuermitte! (60) auf ei- 
nen ersten Zustand eingestellt ist, der die Ver- 
wendung der Software In dem Zentraiprozes- 
sor (16) eriaubt. Oder auf einen zweiten Zu- 
stand, der die Verwendung der Software be- 
schrankt, und worin das Steuermitte! (60) von 
dem zweiten Zustand in den ersten Zustand 
zurOckgestellt werden kann. 

13. Vorrichtung nach einem der vorangehenden 
Anspruche, die ferner ein Sendemtttel aufweist, 
das mit dem Steuermittel und dem Unterbre- 
chungsmittel verbunden ist fQr die Obersen- 
dung von Wamsignalen, die von dem Steuer- 
mittel erzeugt werden, an den Zentraiprozes- 
sor. 

14. Vorrichtung nach einem der AnsprGche 1 bis 

12, worin das Unterbrechungsmittel mit wenig- 
stens einer Bedienungs-Datenstation verbun- 
den ist wobei die Vorrichtung femer ein Sen- 
demittel (72) aufweist. das mit dem Steuermit- 
tel und dem Unterbrechungsmittel verbunden 
ist fur die Ubermittlung von Wamsignalen, die 
von dem Steuermittel erzeugt werden, an we- 
nigstens einen der Bedienungs-Datenstationen 
und den Zentraiprozessor. 

15. Vorrichtung nach einem der vorangehenden 
Anspruche, worin das Unterbrechungsmittel 
(58, 70) durch eine Datensignalverbindung (12) 
mit dem Zentraiprozessor (16) verbunden ist 
und worin das Empfangsmittel (72) mit der 
Datensignalverbindung (12) verbunden ist. 

16. Vorrichtung nach einem der AnsprGche 1 bis 

13. worin der Zentraiprozessor des Computer- 
systems eine Sicherheitssignalverbindung (18) 



hat und worin das Unterbrechungsmittel (58. 
70) und das Empfangsmittel mit der Sicher- 
heitssignalverbindung (18) des Zentralprozes- 
sors (16) verbunden sind. 

5 

17. Vorrichtung nach einem der AnsprGche 1 bis 
13, worin der Zentraiprozessor (16) des Com- 
putersystems eine Sicherheitssignalverbindung 
(18) und eine Datensignalverbindung (12) hat 

70 worin das Unterbrechungsmittel ein Mlttel (58). 
das mit der Datensignalverbindung (12) ver- 
bunden ist, und ein Mittel (70), das mit der 
Sicherheitssignalverbindung (18) verbunden ist. 
aufweist und worin das Empfangsmittel mit 

75 der SicherheitssignalveriDindung veriaunden ist 

18. Vorrichtung nach Anspruch 16 Oder Anspruch 
17. worin das Sendemittel (72) mit der Sicher- 
heitssignalverbindung verbunden ist 

20 

19. Vorrichtung nach Anspruch 18. worin das Sen- 
demittel mit der Datensignalverbindung ver- 
bunden ist. 

25 20. Vorrichtung nach einem der vorangehenden 
Anspruche, worin das Speichermittei (82) in 
einem Element angeordnet ist, das aus der 
Vorrichtung entfembar ist. 

30 21- Vorrichtung nach einem der vorangehenden 
Anspruche, worin das Speichermittei (82) fer- 
ner ein programmierbares Speichermittei auf- 
weist. in dem die Daten des Speichermittels 
geandert werden konnen. 

35 

22. Vorrichtung nach Anspruch 21 , worin das Spei- 
chermittei (82) einen EEPROM aufweist 

23. Vonichtung nach einem der vorangehenden 
40 AnsprGche, worin der Zentraiprozessor (16) 

des Computersystems ein Betriebssystem hat 
und worin die Vorrichtung femer ein zusatzii- 
ches Speichermittei (80) aufweist, das mit dem 
Steuermittel verbunden ist und Daten bezGg- 
45 lich des Betriebssystems des Zentralprozes- 
sors (16) enthalt. 

24. Von-ichtung nach Anspruch 20, worin das zu- 
satzltche Speichermittei (80) einen EEPROM 

so aufweist 

25- Vorrichtung nach einem der vorangehenden 
AnsprGche, worin das Empfangsmittel und das 
Unterbrechungsmittel (72) ein Mittel aufweisen. 
56 um eine zusatzliche Softwarevenvendungs- 

Uberprufungsvorrichtung damit in Serie zu 
schalten, wobei die Vonrichtung femer mehrere 
Software-UberprGfungsvorrichtungen aufweist. 
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die in Serie geschaltet sind, fOr die Oberpru- 
fiing von zusatziicher Software in dem Compu- 
tersystem. 
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